1. Notification.
2. Developer shall notify Platform Science within forty-eight (48) hours of becoming aware of a Data Security Incident. Developer shall provide Platform Science with a detailed description of the Data Security Incident, the type of data that was the subject of the Data Security Incident and, to the extent known to Developer, the identity of each affected person, as soon as this information can be collected or otherwise becomes available, as well as all other information and cooperation that Platform Science may request. The Parties shall cooperate in determining whether notification to affected individuals and/or government authorities is required under applicable Data Protection Laws. If notification is required, Developer shall pay all costs of such notifications.
2. Mitigation.
3. Developer agrees to take action immediately, at its own expense, to investigate the Data Security Incident and to identify, prevent, and mitigate the effects of the Data Security Incident and, with Platform Science’s prior written agreement, to carry out any recovery or other action necessary to remedy the Data Security Incident. Developer shall inform Platform Science of the steps it is taking to mitigate the effects of the Data Security Incident and to minimize the chances of another Data Security Incident happening again.
3. Publicity.
4. Except as explicitly required by Data Protection Laws, Developer shall not issue, publish or make available to any third party any press release or other communication concerning the Data Security Incident without Platform Science’s prior written approval or request.
4. Cooperation.
5. Developer shall provide full cooperation and assistance to Platform Science to enable Platform Science to fulfill its obligations to enable Data Subjects affected by the Data Security Incident to exercise their rights under the Data Protection Laws. Developer shall notify Platform Science within three (3) business days of all communications Developer receives from an affected Data Subject seeking to exercise their right in connection with the Data Security Incident.